Brute Force Attack.

What is a brute force attack?

A brute force attack is a method of guessing passwords or other secret values by trying many combinations until one works. MITRE ATT&CK describes the Brute Force technique (T1110) as adversaries using brute force to gain access to accounts when passwords are unknown or when password hashes are obtained, by systematically guessing the password with a repetitive or iterative mechanism. NIST defines a brute force password attack as a method of accessing an obstructed device by attempting multiple combinations of numeric or alphanumeric passwords.

How does a brute force attack work?

OWASP explains that the attacker uses predetermined values, makes requests to a server with those values, and then analyses the responses. The attacker can use a dictionary, which is a list of likely values, or can try combinations of different character classes.

MITRE says this activity can happen online, through service validation, or offline, against credential data the adversary has already obtained. It also says brute forcing can happen at various points during a breach, including after a compromise, using data from credential dumping or account discovery, and at initial access.

What are the types of brute force attack?

MITRE ATT&CK lists four sub-techniques under Brute Force.

• Password Guessing (T1110.001)
• Password Cracking (T1110.002)
• Password Spraying (T1110.003)
• Credential Stuffing (T1110.004)

MITRE says the technique is used when passwords are unknown or when password hashes have been obtained. A password hash is a scrambled form of a password that a system stores instead of the password itself.

What does a brute force attack look like in simple terms?

This is a simple illustration. A login page has no limit on failed attempts. An attacker feeds it a list of common usernames and passwords until one pair is accepted. OWASP describes this case: when no account lockout policy exists, attackers use lists of common usernames and passwords to brute force a field until authentication succeeds.

OWASP also shows the same idea used to find hidden resources. A tool requests known page names from a word list and reads the response codes to see which pages exist.

How can you reduce the risk of brute force attacks?

The sources suggest these steps.

• MITRE recommends account lockout after failed login attempts, and conditional access restrictions.
• MITRE recommends multi-factor authentication, especially on externally facing services. This means asking for a second proof of identity besides the password.
• MITRE recommends following NIST guidelines when creating password policies.
• MITRE recommends resetting accounts that are known to be breached or that show signs of brute forcing.
• OWASP recommends account lockout after failed login attempts and tools that detect the scanning patterns typical of brute force tools. It also notes that attackers can get false positives when a server returns HTTP 200 but shows a “File not found” message.

How does it relate to nearby terms?

Related terms are credential theft and multi-factor authentication. MITRE lists multi-factor authentication as a mitigation for brute force.

Is a brute force attack the same as a dictionary attack?

Not exactly. OWASP treats dictionary attacks and traditional brute force with character classes as two ways to carry out a brute force attack. The dictionary approach uses a list of likely values. The traditional approach tries combinations of characters.

Does a brute force attack only target passwords?

No. MITRE focuses on password guessing for account access. OWASP also describes using the same method to discover resources on a server, such as directories.

Where does Brandefense fit?

Brandefense offers dark web monitoring.